Windows 11 Home: Enhanced sign-in security toggle missing in Sign-in options with ESS enabled fingerprint reader

Question

Windows 11 Home: Enhanced sign-in security toggle missing in Sign-in options with ESS enabled fingerprint reader

WFGDS 20

On a Windows 11 Home Version 25H2 PC, I have Windows Hello Fingerprint recognition set up and have successfully enrolled two fingerprints. Everything seems to be working properly when logging in, but I have noticed a small anomaly. In the Additional settings section on the Settings > Accounts > Sign-in options page, the Enhanced sign-in security toggle is missing. Instead, I have a toggle that says 'Sign in with an external camera or fingerprint reader (Use Windows Hello without enhanced sign-in security.)' I have toggled this to off as recommended to enable ESS, but I'm wondering why I see this instead of the expected 'Enhanced sign-in security' toggle. I'm using a Kensington VeriMark Desktop 2.0 Fingerprint Reader which is showing up in Device Manager with the Windows driver, and it supposedly meets Microsoft’s Enhanced Sign‑in Security (ESS) requirements with native Windows Hello integration. Also, Event Viewer has three Event ID 1108 entries every time I log in with the fingerprint reader; the first two entries show 'The sensor's mode is "Basic," its pool-type is "System," and it's isolated in a "Local System" process.' (non-ESS), while the last entry shows 'The sensor's mode is "Advanced," its pool-type is "System," and it's isolated in a "Virtual Secure Mode" process.', (ESS log-in).

WFGDS 20 Reputation points

2026-08-19T23:00:22.77+00:00

Virtualization-based Security is listed as Running. In Running Tasks, ngciso.exe is present but Not Available and bioiso.exe is not present.
WFGDS 20 Reputation points

2026-08-19T23:12:49.9366667+00:00

Virtualization-based Security is listed as Running, ngciso.exe is present but Not Available and bioiso.exe is not present.

Answer accepted by question author

Hendrix-V 18,685 Microsoft External Staff Moderator

Hi WFGDS,

Based on what you've described, this appears to be more of a Windows UI variation than an indication that Enhanced Sign-in Security (ESS) is not working. Since fingerprint sign-in is functioning normally and the"Sign in with an external camera or fingerprint reader" setting is already turned Off, that aligns with the documented behavior for keeping ESS enabled.

As a quick verification, you can:

Open System Information and confirm Virtualization-based Security shows Running.
Check that bioiso.exe and ngciso.exe are present in the running tasks list.
Leave the external fingerprint reader setting Off.

Regarding the Event ID 1108 entries, the available documentation does not clearly define the meaning of the Basic-to-Advanced sensor mode sequence, so those entries alone do not necessarily indicate a problem with ESS operation.

Let me know if you need further assistance, feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 comments

1 additional answer

Your answer

WFGDS 20 Reputation points

2026-08-19T23:00:22.77+00:00

Virtualization-based Security is listed as Running. In Running Tasks, ngciso.exe is present but Not Available and bioiso.exe is not present.
WFGDS 20 Reputation points

2026-08-19T23:12:49.9366667+00:00

Virtualization-based Security is listed as Running, ngciso.exe is present but Not Available and bioiso.exe is not present.

Answer 1

What is being shown is consistent with the documented UI behavior for the older ESS control label, not necessarily a sign that ESS is failing.

On Windows 11 version 24H2 or newer, the documented label under Settings > Accounts > Sign-in options > Additional settings is Enhanced sign-in security.
On Windows 11 version 23H2, the documented label is Sign in with an external camera or fingerprint reader.
In that older-style UI, toggle Off = ESS enabled and toggle On = ESS disabled.

So the key functional meaning is:

If “Sign in with an external camera or fingerprint reader” is Off, ESS is enabled.
If it is On, ESS is disabled so external peripherals can be used for sign-in.

For an external fingerprint reader specifically:

Windows documents that peripheral ESS fingerprint scanners are supported on capable hardware and supported OS.
If the device is ESS-capable, under Additional settings the device should be in a good ESS state when it shows Pending set up before enrollment.
After enrolling the fingerprint using the ESS scanner, ESS will be enabled.

A few important points match the described behavior:

ESS is not supported for external camera modules, so the wording around external devices exists partly because that setting controls whether non-ESS external peripherals are allowed.
If the expected toggle text is not shown, Windows also notes that feature rollout can happen in phases, so not all devices show the same experience at the same time.
Availability of sign-in settings can also vary based on device configuration.

About the Event Viewer entries:

The available documentation confirms that with ESS enabled, biometric isolation components should run as bioiso.exe and ngciso.exe, and that secure biometric operation uses the secure component path.
The documentation provided does not define the exact meaning of the specific Event ID 1108 sequence or explain why both Basic and Advanced sensor mode entries appear in one sign-in, so no supported conclusion can be drawn from those log details alone.

If the goal is to verify ESS state using supported checks:

Open Settings > Accounts > Sign-in options > Additional settings.
If the visible control is Sign in with an external camera or fingerprint reader, keep it Off to keep ESS enabled.
Open System Information > System Summary and confirm Virtualization Based Security is Running.
In System Information > Software Environment > Running Tasks, confirm bioiso.exe and ngciso.exe are present.

If fingerprint sign-in is working and the external-device toggle is Off, that aligns with ESS being enabled according to the documented behavior for that toggle.